Private asides

Private asides

A room where everyone reads everything is a group chat. An aside is a message addressed to fewer people than the conversation it lives in: two agents on a desk comparing notes, with the rest of the desk seeing that an exchange happened and not what it said.

Every biological system this project borrows from works that way. Trophallaxis is a pairwise contact, a waggle dance has a local audience, quorum sensing reads a local concentration. Information diffuses through bounded contacts and is aggregated; it is not broadcast.

What a message carries

A message names an audience, and a reader is a viewer:

pub enum Audience {
    Desk,                            // every reader of the conversation
    Aside { members: Vec<String> },  // the author plus these ids
}

pub enum Viewer {
    Operator,                // reads every row in full
    Person { id: String },   // reads every row in full — audit, not membership
    Agent { id: String },    // reads a row only if its audience admits it
}

A person reads everything. No exchange here is unauditable by a human, and a person reading an aside does not join it or change what its agents are told. That is read-only audit access, deliberately not membership.

Three rules

A redaction is a row, not an absence. A non-member does not silently lose messages. It sees an attributed stub — who spoke to whom, how many messages, and where the exchange was settled in the open:

[7-10] @planner → @auditor · aside, 4 messages · settled at [11]

A run of rows from one aside collapses into a single stub, so a twelve-message exchange costs a reader one row rather than twelve. A citation landing inside the range resolves to the stub, which is the honest answer: you are pointing at something you may not read.

An aside carries information, never support. A trace inside an aside adds no supporter, moves no standing, and counts for nobody — including its own members. The filter is uniform for every reader, so quorum, the floor and the directory stay single-valued. To make a private finding count, a member spends a desk-visible turn saying so in the open. See ADR 0010.

An aside is not a turn. It rides alongside the turn that authored it: one authorized turn writes its ordinary desk-visible move and, optionally, one private row. The episode cannot tell — a private row is dropped before it reaches a trace, a standing, the sequence they fold at, or the floor, and the turn budget counts turns rather than rows. That is asserted by a fuzz invariant over arbitrary transcripts, not by argument. See ADR 0011.

Off the floor

Riding alongside a turn makes an aside free, but still rations it: a room converging in eleven turns writes at most eleven private rows. A host may instead run exchange rounds between turns, in which each member the library names appends one private row, taking no floor and producing no turn:

pub fn exchange(policy, state, transcript, roster, desks) -> Result<ExchangeRound>

Off by default, bounded by two finite ceilings a host reads off its own policy before starting, and spend is folded from the transcript rather than stored — so there is no counter that could disagree with the log. What a round spends is model calls, which is a real cost and a host's to authorize. See ADR 0012.

Does it help?

Sometimes, and much less than the information is worth. The short version is that a private exchange charged a floor turn costs about seventeen points on a hidden profile, that the cost is the turn rather than the privacy or the content, and that free pooling of the same information would be worth thirty. Privacy itself is never the variable: an arm that says the identical words in the open lands inside the interval of the one that whispers them.

Benchmarks: private exchange has the arms, the controls and the numbers.

Context, for a reader with a window

An aside creates divergent contexts that decay at different rates, and the reader is a model with a sliding window. Three consequences shape the design:

• A non-member must not merely lose the content — it must know a hole exists and where it was resolved. Hence the stub, and its forward pointer to the settlement.
• A member must be able to re-find what it said privately after the window has moved. !pin works inside an aside for its members.
• Stubs must not eat the budget. Consecutive rows from one aside collapse to one.

The briefing states the situation as an instruction rather than a disclaimer: some rows show only that an aside happened, you cannot read them, and if one matters you ask its author in the desk.